Real-time HTTP callbacks for statement, transaction, account, and rule events — so you don't have to poll the API to know when something changed.
transaction.created fires once rules have already been applied, so the payload includes the final category — not a raw, uncategorized row.
Every delivery is a thick payload — the full resource, not just an id — wrapped in the same envelope:
{
"event_id": "evt_3f8k2m9pXqRvT1",
"event_type": "transaction.created",
"created_at": "2025-01-14T09:22:00Z",
"data": { /* full transaction object */ }
}event_id is unique per delivery attempt — use it to dedupe retried events on your end. transaction.created fires per transaction, never batched.
Every request carries X-FOB-Timestamp, X-FOB-Signature, and X-FOB-Event headers. Verify the signature over `${timestamp}.${body}` before trusting a payload.
Non-2xx responses are retried up to 5 times with backoff. Enforce your own replay window (reject timestamps older than a few minutes) alongside signature checks.
Each org configures a single endpoint URL and secret, then opts into the specific events it wants — not all-or-nothing. Set it up from your org's Settings → Webhooks page, or keep polling the REST API instead if you'd rather not run a receiver.
Go to your org settings →